CVE-2026-49332

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

State: Published
Severity: 8.5 High
Published: Jul 28, 2026
Updated: Sep 21, 2026
Reserved: May 29, 2026

Read the record on cve.org

Description

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.

Scores

CVSS	Score	Vector	Source
3.1	8.5 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N	redhat

Weaknesses

CWE-436 Interpretation Conflict

Affected Products

Product	Versions
Red Hat OpenShift Container Platform 4.12Red Hat	1786458704 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	1786477436 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat	1785549818 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat	1787054100 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	1785544039 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat	1787543313 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	1785529735 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat	1785521728 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat	1785833742 and laterNot affected
Red Hat OpenShift Container Platform 4.21Red Hat	1785851359 and laterNot affected
Red Hat OpenShift Container Platform 4.22Red Hat	1785885351 and laterNot affected

References

RHSA-2026:50681vendor-advisory
RHSA-2026:50758vendor-advisory
RHSA-2026:51007vendor-advisory
RHSA-2026:51013vendor-advisory
RHSA-2026:51022vendor-advisory
RHSA-2026:51025vendor-advisory
RHSA-2026:51038vendor-advisory
RHSA-2026:54188vendor-advisory
RHSA-2026:54206vendor-advisory
RHSA-2026:56912vendor-advisory
RHSA-2026:60023vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-49332vdb-entry
RHBZ#2483253issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.